EUVD-2026-46284
GHSA-q3fm-5c2w-6758
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires an authenticated group admin (PR:H) reachable over the network (AV:N) with no interaction; IDOR crosses authority to root RCE, justifying S:C and C/I/A:H.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object reference (IDOR) that lets an authenticated group administrator manipulate object references beyond their authority. The flaw carries a CVSS 9.1 rating because a scope change allows a lower-tier admin to fully compromise the underlying host on Linux/Unix, though impact is reduced on Windows deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated group administrator account on Serv-U (CVSS PR:H) - this is the explicit prerequisite stated by the vendor, not a generic 'access required' condition, meaning the attacker must already hold delegated administrative privileges on the server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) shows network reach, low complexity, no user interaction, and a scope change to full host compromise, offset by a high-privilege prerequisite (PR:H = group administrator). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A partially-trusted group administrator in a multi-tenant Serv-U deployment authenticates to the admin interface and manipulates a user-controlled object identifier to reference configuration or objects outside their delegated scope. By abusing the IDOR they escalate privileges and execute code as root on the Linux/Unix host, taking over the entire file-transfer server and all tenants' data. … |
| Remediation | Patch available per vendor advisory: upgrade Serv-U to the fixed release documented in the Serv-U 2026-3 release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm) and follow the CVE advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28302; the exact patched build number should be confirmed against those pages before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: restrict Serv-U administrative interfaces to trusted networks only via firewall rules and IP-based access controls; audit administrative logs for the past 60 days to identify suspicious session activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a bro
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today